← Home

@financial-times/pro-ask-ft-kit

npm

This package contains the Shared utils between App and Web versions & UI components for App version, which will give us the freedom to develop our components in isolation using TS & React giving us a better DevX

51
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

the-ftrowanmanningcheealexwilsonaendraemmalewisnotleehamza.samihrobertboultonleila.micollierrobgodfrey

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@financial-times/o3-tooltip AI (phantom-deps): Same org scope; likely used indirectly via CSS/design tokens rather than direct JS import. ai
phantom-deps phantom-dep:@financial-times/o3-foundation AI (phantom-deps): Same org scope; likely used indirectly via CSS/design tokens rather than direct JS import. ai
source-diff obfuscated-file:dist/node_modules/parse5/node_modules/entities/dist/esm/generated/decode-data-html.js AI (source-diff): HTML entity decode table for parse5/entities — known minified data file, not malicious obfuscation. ai
source-diff obfuscated-file:dist/node_modules/parse5/dist/common/error-codes.js AI (source-diff): Minified parse5 error-codes enum — legitimate bundled dependency of react-markdown. ai
source-diff source-size-tripled AI (source-diff): Size increase explained by bundling parse5 and entities as transitive deps of react-markdown/rehype-raw. ai
source-diff large-new-source-files AI (source-diff): 188 new files are parse5/entities bundle artifacts from newly added react-markdown dependency. ai
source-diff obfuscated-file:dist/images/ask-ft-generating.json.js AI (source-diff): File is a base64-encoded Lottie animation asset, not obfuscated malicious code. Stable pattern for this package. ai
source-diff obfuscated-file:dist/images/generating-animation.gif.js AI (source-diff): File is a base64-encoded GIF data URI assigned to a JS constant — not obfuscated code. ai
phantom-deps phantom-dep:date-fns AI (phantom-deps): Declared dependency; used indirectly via react-markdown. Stable false positive. ai
phantom-deps phantom-dep:rehype-raw AI (phantom-deps): Declared dependency; used indirectly via react-markdown. Stable false positive. ai
phantom-deps phantom-dep:use-sync-external-store AI (phantom-deps): Declared dependency; used indirectly via React. Stable false positive. ai

Versions (showing 51 of 98)

View all versions
Version Deps Published
0.5.2 3 / 34
0.5.1 3 / 34
0.5.0 3 / 34
0.4.1 3 / 34
0.4.0 3 / 34
0.3.11 3 / 34
0.3.10 3 / 34
0.3.9 3 / 34
0.3.8 3 / 34
0.3.7 3 / 34
0.3.6 3 / 34
0.3.5 3 / 34
0.3.4 3 / 34
0.3.3 3 / 34
0.3.2 3 / 34
0.3.1 3 / 34
0.3.0 3 / 34
0.2.9 3 / 34
0.2.8 3 / 34
0.2.7 3 / 34
0.2.6 3 / 34
0.2.5 3 / 34
0.2.4 3 / 34
0.2.3 3 / 34
0.2.2 4 / 34
0.2.1 4 / 34
0.2.0 4 / 34
0.1.4 2 / 34
0.1.3 2 / 34
0.1.2 2 / 34
0.1.1 2 / 34
0.1.0 2 / 34
0.0.67 2 / 34
0.0.66 2 / 34
0.0.65 2 / 34
0.0.64 2 / 34
0.0.63 2 / 34
0.0.62 2 / 34
0.0.61 2 / 34
0.0.60 2 / 34
0.0.59 2 / 34
0.0.58 2 / 34
0.0.57 2 / 34
0.0.56 2 / 35
0.0.55 2 / 35
0.0.54 2 / 35
0.0.53 2 / 35
0.0.52 2 / 35
0.0.51 2 / 35
0.0.50 2 / 35
0.0.49 2 / 35

v0.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.